FILE ACCESS MONITORING WITH OSQUERY ON MACOS

Summary from the TLDR InfoSec newsletter

File Integrity Monitoring is limited in the modern age as files containing things like access keys, API keys, and secrets are frequently used. Osquery on macOS can hook into the es_process_file_events table to allow users to define a set of sensitive files to monitor for any accesses or changes. This post contains a tutorial for enabling and configuring Osquery.